Ethereal-dev: Re: [ethereal-dev] 0.7.7: Problems filtering ip.addr with < or > operators

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: a.pfaller@xxxxxxxxxx (Andreas Pfaller)
Date: Sat, 30 Oct 1999 19:11:38 +0200
> On an Intel platform, right? I'm guessing that you are using
> a little-endian platform.
> 
yes.

> Right. The ipv4 address mechanism in the display filter routines store
> the address as 32-bit unsigned ints in network order, not host order.
> On a little-endian machine, you'll be out of luck when using < and >
> (and <= and >=), since network order is big-endian.
> 
> I have recently been thinking about how to represent subnets within
> the display filter routines, so that something like:
> 
>       ip.addr ne 192.168.1.0/24
> 
> would match a packet with either IP address not on your Class-C subnet.
> 
> Would that be a viable solution?
>
Sure, although I can certainly imagine cases where filtering with
relational operators is still nice (e.g. some clusters which are not
grouped together in a subnet).

Andreas (a.pfaller@xxxxxxxxxx)